Mike's Blog

Gospel study notes and technical journal

Posts Tagged networking

Windows 7 to Windows 2000 network connection

Feb 22

Posted by mbrinson in Technical Journal, Technology Recipes | No Comments

You need to tweak a registry setting in order to allow connecting to a windows share that is shared on a windows 2000 or xp machine from a Windows 7 machine. Here is the technet article that describes the registry setting that needs to be changed:

http://technet.microsoft.com/en-us/library/cc960646.aspx

Here is the relevant part from the post:

LmCompatibilityLevel

HKLM\SYSTEM\CurrentControlSet\Control\Lsa

Data type

Range

Default value

REG_DWORD

0–5

0

Description

Specifies the mode of authentication and session security to be used for network logons.

Value

Meaning

0

Clients use LM and NTLM authentication, but they never use NTLMv2 session security. Domain controllers accept LM, NTLM, and NTLMv2 authentication.

1

Clients use LM and NTLM authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.

2

Clients use only NTLM authentication, and they use NTLMv2 session security if the server supports it. Domain controller accepts LM, NTLM, and NTLMv2 authentication.

3

Clients use only NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.

4

Clients use only NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controller refuses LM authentication responses, but it accepts NTLM and NTLMv2.

5

Clients use only NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controller refuses LM and NTLM authentication responses, but it accepts NTLMv2.

Tags: ,

Windows 98 file sharing

Dec 11

Posted by mbrinson in Technical Journal | No Comments

I spent a while trying to figure out why I couldn’t connect to a Win98 folder share that I had in a VMWare Virtual Machine. I was using Share-Level access control:


So I should have been able to just provide the password and I would be good to go. But I could not get connected. I kept getting a prompt for the password and it kept telling me the password was incorrect.

 
 

Long story short.. I finally realized that Win98 only allows up to 8 characters for a share-level password.


I was inputting a 9 character password and didn’t realize that it was cutting off the last character. Of course Windows XP accepts more than 8 characters for a password and so it was happily accepting all 9 characters and consequently it was not matching up with the password contained on the Win98 share which was comprised of only the first 8 characters.

I cut off the last character for the password I was inputting on the XP side and Walla. Problem solved.

Tags: ,

Ping – “Hardware Error”

Nov 25

Posted by mbrinson in Technical Journal | No Comments

I went over to Blaine Steele’s house to help him with a wireless router issue. Everything worked fine if wired through the router, but intermittent problems through wireless connection. Ping responses were up and down, sometimes wouldn’t connect to AP, other times it would and then couldn’t get a PING response from the default GW.

When PINGING 192.168.1.1 I would get “Hardware Error” as a response. I searched online for a while without finding any solutions.

Here is the solution:

The channel that the wireless access point was operating on was getting interference from some other device in the vicinity. Just try different channels on the wireless router until the problem clears.

Tags: , ,

Linux mount network share via CIFS

Oct 16

Posted by mbrinson in Technical Journal, Technology Recipes | No Comments


Place the following in the /etc/mtab file at the end of the file:
//ip.addr(or name)/sharedFolder /local/directory cifs rw,mand 0 0

Okay, so I’ve since learned that you don’t need to or even want to modify the /etc/mtab file. This file lists the currently mounted file locations or block devices. (thus “mtab”… Mount Table)

Also in the /etc/fstab you need to place the following at the end of the file:
//ip.addr(or name)/sharedFolder /local/directory cifs defaults,rw,username=username(whatever it is),password=password(whatever it is) 0 0

In the fstab entry the elements need to be separated by "tab" instead of "space" except for at the end (0 0) The 0's are separated by a space.

Tags: ,

TCP/IP – TCP/IP has reached the limit on concurrent conections, windows xp err.

Sep 9

Posted by Mike in Technical Journal | No Comments

Just to inform you all that the culprit of this specific problem of disconnection from ROUTER from my LAN was in fact a driver issue. Thank you all.

via TCP/IP – TCP/IP has reached the limit on concurrent conections, windows xp err..

Stuart’s laptop had this error message a couple of times but not excessively.  But this combined with the other error that it was getting more frequently -> “Timed out sending notification of device interface change to window of “IWMSWindow” made me think they have an issue with a driver.

The original reason they brought it to me was a problem with the keyboard where no matter what the repeat rate was set to in control panel -> Keyboard settings,  it would go very slow.  I was over at their house and witnessed this and spent a while tried to fix it, but could not.  When I first looked at it at my house it was not having this issue and I couldn’t get it to replicate the behavior.  Odd.  I’m sure the problem will crop up again.  Unfortunately nothing I can do about it for now.  Will have to wait until it becomes a problem again and see if I can find something out.

Tags: , ,

SG560 Packet Filtering for forwarded packets vs Access Control

Sep 5

Posted by Mike in Technical Journal, Technology Recipes | No Comments

Spent all day trying to figure out why some of my packet filtering rules weren’t working.  I’ve got two SG560 units VPN’d together via an IPSec tunnel.  One has version 3.1.6 firmware and the othr has version 3.2.2

It appears that between these two version they handle the “Access Control” feature differently.  With 3.1.6 when you enable the “Access Control” for “Internet”:

AcessControl1

and don’t even choose to block or enable anyone in the ACL

ACL List

ACL List

then it changes the way packets are generated.  It suppresses the triggering of the Packet Filter rule for port 80 and delegates control over that to the authd or Access Control feature.   That is for firmware version 3.2.2.  For version 3.1.6 the Packet Filter rule is still triggered.

Images below with descriptions:

Version 3.2.2

So I remembered it wrong.  The source address does not change, but the packet filter rule based on “Type: Forward” is not triggered.  Rather the “authd” is triggered (I think this is a different service or daemon from ipchain).  I just spent some time googling it and here is a description for Authd

Here the Packet Filter rule is enabled for Type: Forward and port 80, but it is not triggered.

Here the Packet Filter rule is enabled for Type: Forward and port 80, but it is not triggered.

Here the ACL within the Access Control is set to block port 80 and authd is triggered.

Here the ACL within the Access Control is set to block port 80 and authd is triggered.

In this case (to the left) the “All Forward Block” is being triggered for a ping request which uses ICMP and thus the rule is triggered.  But the other rule that is active for blocking Type: forward for port 80 is not triggered.  It is suppressed somehow and authd is put in its’ place.


Version 3.1.6

Okay, so after exhaustive testing I have concluded that there is no difference between the firmwares.  But when I first went through this exercise last week (didn’t have time to document last week when I first went through my testing) I could have sworn that each firmware was handling he packets differently.  But now every test I do shows that they handle it the same.

Bottom line:

You must have Access Control disabled in order for the Packet Filter rules for the Type: Forward to be triggered.  At least for outbound traffic going out from the internal network.  I haven’t and am not planning on testing for packets forwarded from the outside in using port forwarding.

If you have Access Control enabled you can then use the ACL to determine which hosts will be blocked or allowed which will use the “authd” protocol, application, whatever you want to call it, to perform the blocking.

Whew… I’m done.

Tags: , ,

Gigabit to Gigabit NIC connection (No crossover cable needed)

Aug 24

Posted by Mike in Technical Journal, Technology Recipes | No Comments

With gigabit, you don’t need to worry about crossover, just connect them with one of your cat6 cables.

via What’s the REAL speed of 1 Gigabit network connection? – Topic Powered by Eve Community.


So actually it turns out (after a little more googling) this is not always true.  It depends on the PCs/Devices being connected together.  Some support auto-negotiation and others don’t.

Here is the pinout for making a gigabit crossover cable (different than 100 Base-T crossover)

Pin Connector #1 Connector #2
1 white/orange white/green
2 orange green
3 white/green white/orange
4 blue white/brown
5 white/blue brown
6 green orange
7 white/brown blue
8 brown white/blue

Tags: , , , ,

Flashing Cyberguard SG560

Aug 21

Posted by Mike in Technical Journal | 4 Comments

Had quite the adventure this morning.  Decided to upgrade firmware to 4.0.4 which has been completely rebranded by McAfee who have apparently bought out Secure Computing.

After upgrading I had some issues.  Web interface was MUCH slower due to the graphical enhancements (graph showing CPU usage and other stuff on the first page, etc.)  I could have lived with the slowness, but the device kept inexplicably rebooting.  Seemed like it was running out of memory or something.  It seemed to run fine until I went in to make changes to the unit and then it would reboot.

SG560FlashSo, I decided to downgrade back to the latest version of the Secure Computing version of the firmware before they were bought out by McAfee and the firmware was rebranded.  I found that you can do that by including the “-i” option in “Extra Parameters” as shown to the left.

It worked but after it finished I no longer got  any response from the SG560.  I went back to look at it and all of the LED lights were flashing in unison.  It had been a long time since I had flashed it and had forgotten that this is normal for when the unit is needing to be configured.  It means that the default settings have been cleared and it has a default IP address of 192.168.0.1   There is no DHCP server enabled and so you have to assign a static IP address to your laptop or whatever you’re connecting to the SG560 with.  You have to connect directly to it via a network cable and then you can restore the config backup or whatever.  Default login is:       root
Password:  default

I spent a lot of time trying to figure out what the problem was.  Ended up downloading the netflash.exe tool (for use with all SG models) and doing a unit recovery.  Also had to download the recovery file “recovery version 1.0.4 for SG560” in connection with the netflash tool.  Ran this and had an issue at first where it just sat there trying to do the recovery:

SG560RecoverySG560RecoveryAssignIPI couldn’t get the capture for the actual problem I had.  It said something about there being more than one interface on my PC and asking if the one referenced by the IP address it showed was the right one.  It was the Hamachi adapter.  I choose no but then it would not work.  I think it’s supposed to choose the other available adapter when you choose no, but if that’s what is supposed to happen, it didn’t.  I was able to get it to work by disabling the hamachi adapter in network neighborhood.

SG560RecoverySelectRecoveryFileSG560RecoveryHang



So after sucessfully running the recovery I then upgraded the firmware to the older version that I wanted it to be at (3.2.2)  I still hadn’t understood that all the lights flashing in unison was an indication that it was needing to be configured (ie: assign static IP address to laptop in 192.168.0.0 subnet, connect to the web management at http://192.168.0.1 and then restore the backup I had made to begin with.  -> forgot to mention at the beginning that I did make a backup of all the settings before doing the firmware update… (I’m getting a little wiser in my old age.)

Once I realized that I had to redo the recovery a few more times and I was able to get everything going.

One other important note:  To reset the SG560 to default factory settings hit the reset button in the back twice in a row within 3 seconds.  Pretty much just right in a row with no delay between the two depressions.

After reading in a few different versions of the manual for the SG560 I became convinced that the DNS proxy does cache the DNS entries on the device itself and does not register the DNS entries with the DNS server that is owned by your ISP.  It may attempt to, but I think the ISP must have some settings for their DNS server that rejects requests from subscribers to update DNS records on their server for names within their local network.


DNSProxySo I checked the “Update DNS with local DHCP leases”  I was reluctant to do this before because I was afraid that it would register the names with my ISP’s DNS server and somehow other users on the node would be able to get to my devices on my local network.  Even if it does register they shouldn’t be able to get to them because that traffic would be dropped by the firewall settings on the SG560.

I need to get a firmer grasp on all of the packet filter rules on the SG560.  Not entirely confident with this yet.

With the “Update DNS with local DHCP leases” checked I get the expected results when doing an NSLOOKUP on any of the devices on the network.

NSLookupIt shows as non-authoritative, but it does work.  Before I was unable to ping to my laptop when it was connected wirelessly to the network.  I could ping out from the laptop via the wireless connection but could not ping to the laptop.  When connected with an ethernet cable then I could ping to it.  I couldn’t figure this out.  Still can’t.  After rebuilding the SG560 it started working.  Based on this post I do know it had to do with the DNS proxy server not working.  I thought I would have to set up BIND on my debian server (ubuntu) which I haven’t ever done.  Still should probably do that some time for the experience.

The laptop is multihomed by the fact that it has a wireless connection and a wired connection.  Thus the nslookup shows two IP addresses for the name “mikelaptop”  The 192.168.50.61 is the ethernet gigabit lan adapter and the 192.168.50.12 is the intel pro wireless adapter.  When I first tried pinging mikelaptop I did it when the laptop was connected via the gigabit lan adapter and it worked.  Then I disconnected and connect with the wireless adapter.  At first I could not ping as it was still resolving to 192.168.50.61 which was the gigabit adapter.  After using nbtstat -R to clear the netbios lookup cache then it did resolve to the 192.168.50.12 and I got a ping response.

Does that make sense?  Does netbios use DNS?  I just finished researching it and yes, it can resolve via DNS, but there’s more to it than that.  More information here.

UPDATE – August 3, 2011: Since it looks like eventually the firmware files may no longer be available from McAfee, I decided to grab some of the files that pertain to SG560 and put them here for whoever might need them in the future.

DOWNLOAD SG560 FIRMWARE FILES

Tags: , , ,

Name Resolution for PING vs "Net Use"

Aug 21

Posted by Mike in Technical Journal | No Comments

The ping utility and the “net use” utility use different methods for name resolution.Ping uses the DNS for name resolution. Do you have a DNS server configured within the boot menu? If you disable DNS, then the ping utility cannot resolve the name as it won’t use the lmhosts file.”net use” uses the lmhosts file for name resolution. If it is not in the lmhosts file, then it should broadcast out and look for the machine. If the machine is on the same subnet, then it should find it and be able to connect. I only need to use the lmhosts file for machines that are on a different subnet than the client PC.

So, PING Name Resolution => DNS

NET USE Name Resolution => lmhosts, then broadcast.

Ping will not resolve via broadcast.

via Universal TCP/IP Network Bootdisk :: View topic – Help, lmhosts / NET USE issue.

Tags: , , , ,

Disable Windows Messenger broadcasts on UDP port 1900

Aug 20

Posted by Mike in Technical Journal | No Comments

In XP, the Simple Service Discovery Protocol SSDP discovery service searches for Universal Plug and Play devices on your home network. SSDP searches for upstream Internet gateways using UDP port 1900 – a potential security risk many organizations will want to block. OK, you decide to block SSDP services but to your surprise, your firewall and network sniffers continue to see the UDP port 1900 packets. You have disabled XP’s SSDP and even Universal Plug and Play Device Host. Whats going on? This is Universal Plug and Play Network Address Translation NAT traversal discovery used by Messenger. If you run a sniffer trace, the following information is displayed in the data section of the packet:SSDP: Method = M-SEARCHSSDP: Uniform Resource Identifier = SSDP: HTTP Protocol Version = HTTP/1.1SSDP: Host = 239.255.255.250:1900SSDP: Search Target = urn:schemas-upnp-org:device:InternetGatewayDevice:1SSDP: Mandatory Extension = “ssdp:discover”SSDP: Maximum Wait = 3XP’s Windows Messenger is attempting to communicate to an Internet host. To block Windows Messenger’s broadcasts:Hive: HKEY_LOCAL_MACHINEKey: Software\Microsoft\DirectPlayNATHelp\DPNHUPnPName: UPnPModeType: REG_DWORDValue: 2 disabledWith UPnPMode=2, Universal Plug and Play Network Address Translation NAT traversal discovery does not occur.

via Disable Windows Messenger broadcasts on UDP port 1900.

Tags: , ,

Bad Behavior has blocked 462 access attempts in the last 7 days.

Better Tag Cloud